The UK Financial Conduct Authority on April 15, 2026, published CP26/13, the perimeter guidance consultation that defines which cryptoasset activities will require authorization under the forthcoming regime effective October 25, 2027. The document maps seven new regulated activities — from stable...
"We want to develop a sector that embraces innovation and is underpinned by market integrity and consumer trust." — Matthew Long, FCA Director of Payments and Digital Assets
The UK Financial Conduct Authority on April 15, 2026, published CP26/13, the perimeter guidance consultation that defines which cryptoasset activities will require authorization under the forthcoming regime effective October 25, 2027. The document maps seven new regulated activities — from stablecoin issuance to staking arrangement — onto the existing Financial Services and Markets Act 2000 framework, completing the legislative scaffolding that began when Parliament approved the statutory instrument on February 4, 2026.
The UK approach diverges from the EU's bespoke Markets in Crypto-Assets Regulation (MiCA) by folding crypto into existing financial services law rather than building a standalone rulebook. The practical effect: firms already FCA-authorized for traditional activities may avoid a second licensing process, while pure-play crypto firms face a narrow five-month application window opening September 30, 2026. With only 47 of 359 prior anti-money-laundering registration applications approved — a 13% pass rate — the authorization bottleneck is the defining risk for the UK's 147 currently registered crypto firms.
The most contentious provision is the DeFi "controlling entity" test. Activities conducted on a "truly decentralised basis" fall outside the regime. But the FCA will probe every protocol for identifiable controlling persons — foundation-backed DAOs, fee-capturing front-ends, parameter-setting core teams — and apply the full regulatory stack to any entity it identifies. The line between regulated and unregulated DeFi in the UK will be drawn case-by-case, not by statute.
The UK's crypto regime rests on three pillars. First, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, the statutory instrument laid before Parliament in December 2025 and made law on February 4, 2026. This instrument creates the new regulated activities. Second, the FCA's consultation papers — CP25/40, CP25/41, CP25/42, and now CP26/4 and CP26/13 — which translate the statutory language into operational rules and perimeter guidance. Third, the Bank of England's parallel regime for systemic sterling-denominated stablecoins, which remains separate from the FCA framework.
CP26/13, published April 15, addresses the most fundamental question: where does the regulatory perimeter sit? The consultation closes June 3, 2026. The FCA intends to publish final rules in policy statements this summer and final perimeter guidance in autumn 2026. The authorization gateway opens September 30, 2026.
This is not standalone crypto legislation. The UK has deliberately embedded cryptoasset regulation within existing FSMA architecture. The regulatory logic: cryptoassets that function like financial instruments should be regulated like financial instruments. The FCA applies a "same risk, same regulatory outcome" principle.
CP26/13 maps the perimeter for seven specified activities that will require FCA authorization:
1. Issuing qualifying stablecoins. Covers issuance from a UK establishment or on behalf of an issuer in the UK. The definition is narrow: single fiat-referenced tokens only. Multi-currency stablecoins are excluded.
2. Safeguarding qualifying cryptoassets. Custody services — holding assets on behalf of others. Applies regardless of asset ownership structure if the firm maintains requisite control over the assets. Arranging safeguarding is separately regulated.
3. Operating a qualifying cryptoasset trading platform (QCATP). Authorization requirements vary by operational model. The FCA distinguishes between different platform architectures but applies conduct regulation across all.
4-5. Dealing as principal and dealing as agent. Traditional intermediary activities mirroring existing Regulated Activities Order structures for securities. The buy-sell spread model and agency brokerage model are both captured.
6. Arranging deals in qualifying cryptoassets. Intermediary services. Unlike staking, there is no exclusion for purely technical services in this category.
7. Arranging qualifying cryptoasset staking. Covers end-to-end lifecycle management and reward distribution. The FCA explicitly carves out purely technical services: operating validator nodes or offering solo staking tools alone does not constitute regulated activity. This distinction matters — it means infrastructure providers can operate without FCA authorization, while staking-as-a-service platforms cannot.
Qualifying cryptoassets (QCs) must be fungible, transferable, and not solely a record of value or contractual rights. This definition excludes most NFTs but captures all major fungible tokens.
The most consequential language in the regime: activities "undertaken on a truly decentralised basis — i.e., where there is no person that could be seen to be undertaking the activity by way of business — the requirement to seek authorisation will not be applicable."
The relief is narrow. The FCA will examine each protocol to "determine in any given case whether there is an identifiable controlling person conducting specified activities by way of business." The test is functional, not structural. A DAO wrapper does not provide automatic exemption.
Entities likely to trigger the test and face full regulation:
The FCA has stated it will consult separately on detailed DeFi guidance. But the direction is clear: the regulator will look through governance structures to identify economic control. Protocols with meaningful decentralization — no upgrade keys, no fee switches, no identifiable operator — may qualify for the carve-out. The rest face the same regulatory stack as centralized exchanges.
This approach creates a binary outcome. Protocols will either need to demonstrate genuine decentralization — a high bar — or submit to full FCA oversight including operational resilience requirements, financial crime obligations, and prudential standards.
Qualifying stablecoins under the UK regime are defined as single fiat-referenced tokens. The FCA regime covers their issuance, while the Bank of England retains authority over systemically important sterling-denominated stablecoins.
A notable wrinkle: stablecoins fall under FSMA rather than the Payment Services Regulations 2017. A "supply of goods and services" exemption exists but its scope remains undefined. The statutory instrument specifically excludes P2P stablecoin payments from this exemption — meaning peer-to-peer stablecoin transfers may be captured as regulated activity.
The Bank of England's separate proposal for a stablecoin ownership cap has drawn industry criticism. Coinbase has publicly opposed the cap as unnecessary. The dual-regulator model — FCA for conduct, Bank of England for systemic stability — adds complexity that MiCA's single-framework approach avoids.
The timeline is compressed:
| Milestone | Date | |---|---| | CP26/13 consultation closes | June 3, 2026 | | Pre-application support service opens | July 2026 | | Final FCA rules published | Summer 2026 | | Authorization gateway opens | September 30, 2026 | | Authorization gateway closes | February 28, 2027 | | Final perimeter guidance | Autumn 2026 | | Regime goes live | October 25, 2027 | | Extended transitional period ends | October 25, 2029 |
Firms that apply during the five-month window (September 30, 2026 to February 28, 2027) access transitional provisions allowing continued operations for up to 24 months if their application remains undetermined. Firms that miss the window face "cliff-edge risk" — potential forced cessation of UK operations on October 25, 2027.
The FCA's track record on crypto authorization is not encouraging for applicants. Under the existing MLR regime, the regulator received 359 registration applications and approved 47 — a 13% acceptance rate, with over 85% of applications rejected or withdrawn. As of mid-2025, only 147 crypto firms held FCA registration, down from 184 in early 2024.
The new FSMA authorization process is more demanding than MLR registration. It requires capital adequacy assessments, operational resilience plans, governance standards, and financial crime controls. The FCA has not disclosed expected processing times for the new regime, but MiCA licensing in the EU has averaged 9-12 months per application, creating a backlog of over 150 pending approvals.
The UK and EU have taken fundamentally different architectural approaches to crypto regulation:
EU MiCA: Bespoke, purpose-built legislation. Single rulebook across 27 member states. Standalone licensing regime for Crypto-Asset Service Providers (CASPs). As of February 2026, over 40 CASPs are fully authorized under MiCA, with the number projected to reach 150-180 by year-end. Over 1,200 firms applied, with 45% rejected for non-compliance. The grandfathering deadline of July 1, 2026 is forcing a compliance sprint across the continent. In Lithuania alone, the number of authorized VASPs dropped from 350+ under the previous regime to six under MiCA.
UK FSMA integration: No standalone crypto law. Cryptoassets folded into existing financial services architecture. Existing FCA-authorized firms can extend permissions rather than obtaining separate licenses. The "same risk, same outcome" principle means crypto exchanges face conduct requirements comparable to those of traditional securities venues.
The UK model offers a potential advantage for firms already operating under FCA authorization — banks, asset managers, and payment institutions can extend into crypto without a second licensing process. The disadvantage: pure-play crypto firms must meet the same standards as traditional financial institutions, with no crypto-specific accommodation.
Cross-border frictions are significant. UK firms lost EU passporting rights at Brexit. A UK-authorized crypto firm cannot serve EU clients without separate MiCA authorization, and vice versa. The territorial scope of the UK regime further complicates matters: any party "involved" in sales to UK retail consumers triggers UK regulatory scope, effectively limiting offshore broker access.
The FCA's December 2025 consumer research survey (Wave 6) found crypto ownership in the UK fell from 12% of the adult population (approximately 7 million people) in 2024 to 8% (approximately 4.5 million) in 2025. However, mean holdings per person increased, with 21% of holders reporting portfolios between £1,001 and £5,000. Bitcoin remained the dominant asset, held by 57% of UK crypto users.
Awareness remains high at 91% of the adult population, but the ownership decline raises questions about whether stringent regulation is protecting consumers or discouraging participation.
Separately, a survey of 10 major crypto exchanges operating in the UK found that seven reported the banking environment becoming more hostile in 2025. The de-banking problem persists despite government statements urging banks to stop blocking FCA-licensed crypto firms from fair access.
Over 35% of UK institutions reportedly held crypto in 2025, according to FCA data — a figure that may increase as the authorization regime provides institutional-grade regulatory certainty.
Industry response has been divided. Kraken UK Managing Director Bivu Das described the regulatory path as "a major milestone for the UK's crypto ecosystem" but added: "We need to move faster, and we need to be brave on the things that we know will make a difference."
Consensys, the Ethereum-focused software company, has been more critical, arguing that the UK "has ceded crypto hub ground to US amid heavy-handed FCA oversight." The critique echoes a recurring theme: the FCA's cautious posture may push firms toward jurisdictions with clearer or more permissive frameworks.
The FCA is currently testing standardized crypto disclosure templates in its regulatory sandbox with Coinbase, Kraken, and Crypto.com, with RegTech firm Eunice leading template development. Final disclosure rules are expected in the second half of 2026.
The practical concern for most firms is the five-month authorization window. The FCA's pre-application support service, opening July 2026, will be the first concrete indicator of whether the regulator can process applications at scale. Firms that previously spent months or years navigating the MLR registration process have limited confidence in a smooth transition.
CP26/13 defines the perimeter. Seven regulated activities mapped. Consultation closes June 3, 2026. Final guidance expected autumn 2026.
Five-month window is the chokepoint. Firms must apply between September 30, 2026 and February 28, 2027 to access transitional provisions. Missing the window risks forced exit from UK operations.
DeFi is regulated unless provably decentralized. The "controlling entity" test will be applied case-by-case. Foundation-backed DAOs and fee-capturing front-ends are likely captured.
13% historical approval rate. Under MLR, the FCA approved 47 of 359 applications. The FSMA authorization standard is higher.
UK and EU frameworks are not interoperable. Post-Brexit, firms need separate authorizations for each jurisdiction. Cross-border friction is structural, not temporary.
UK crypto ownership declining. From 7 million holders in 2024 to 4.5 million in 2025, even as institutional adoption rises.
The UK's cryptoasset regime, now taking its final regulatory shape through CP26/13, represents a deliberate choice to regulate crypto through existing financial services law rather than building a new framework. The approach offers theoretical elegance — same risk, same outcome — but creates practical challenges. Pure-play crypto firms must meet the same standards as banks and brokers, with no crypto-specific relief and a five-month authorization window that may prove inadequate given the FCA's historical processing record.
The DeFi controlling entity test will be the most closely watched element. It creates a de facto binary: protocols either achieve genuine decentralization or face full regulation. The FCA has deferred detailed DeFi guidance to a separate consultation, leaving the industry in a gray zone during the critical pre-authorization period.
The UK regime goes live 18 months from now. Whether it attracts or repels crypto firms depends on execution — specifically, whether the FCA can process authorization applications at the scale and speed the industry requires. The statutory framework is now largely complete. The operational challenge has just begun.